🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 572fa3dd2128f37601cf91eb9a8a275d93ec207cbec6fe4a998146989797b8ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ConnectWise


Vendor detections: 8


Intelligence 8 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 572fa3dd2128f37601cf91eb9a8a275d93ec207cbec6fe4a998146989797b8ab
SHA3-384 hash: 59fad58f701a624261920cdf7af65fd3609ed87bb7cec0e1ad891ed03b7ad99dbc9b978ebd96c6753cf4f01ac242a4de
SHA1 hash: 81375e29113bbf187c7668151901be093e1fa867
MD5 hash: f9941d5690bf9147da1ffd38e27d9b4c
humanhash: mike-thirteen-violet-stream
File name:cakewallet_payload.vbs
Download: download sample
Signature ConnectWise
Create hunting rule
File size:13'564'633 bytes
First seen:2026-09-05 19:02:10 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:tH5XGiS55Dd3zjT+/Eth5ocSk6249G4QDDUfPOLh:15XGiS55Dd3zjT+/OAcSk54gDDUHOLh
TLSH T1EBD6199E5A0A3544C0838F035993F2BB6F2767FA77967959258D1120F2E1BBCB237813
Magika vba
Reporter Anonymous
Tags:cakewallet ConnectWise dropper RAT screenconnect vbs


Avatar
Anonymous
VBScript dropper delivered via a phishing campaign impersonating CakeWallet (Monero/crypto wallet). Installs a ScreenConnect RAT via clevercarves.com (SHA256 of MSI: 843ba85546072c7b32ce797961f82e5246aac81212e1c251457b137306d839ad). Notifies attacker via Telegram bot API on install success/failure. Full IOC list and static/dynamic analysis available.

Malware delivery URL: https://api.cdn22.net/v1/p/65d3f1eb-04d8-422f-a5a3-9f6f3ee2c263

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/84153/
Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac8df8e3e8173810a5deca7
Tags:
trojan virus spawn
Verdict:
Malicious
File Type:
vbs
First seen:
2026-09-05T18:05:00Z UTC
Last seen:
2026-09-07T17:14:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/572fa3dd2128f37601cf91eb9a8a275d93ec207cbec6fe4a998146989797b8ab/results?tab=lookup
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/572fa3dd2128f37601cf91eb9a8a275d93ec207cbec6fe4a998146989797b8ab
Verdict:
Malware
YARA:
2 match(es)
Tags:
ADODB.Stream Batch Command COM Behavior Trace DeObfuscated MSXML2.ServerXMLHTTP.6.0 Obfuscated PowerShell PowerShell Call Scripting.FileSystemObject Shell.Application SOS: 0.24 T1027 T1047 T1059 T1059.001 T1059.005 T1105 VBScript WinHttp.WinHttpRequest.5.1 WScript.Shell
Link:
https://app.malva.re/file/f9941d5690bf9147da1ffd38e27d9b4c
Gathering data
Threat name:
Script-WScript.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-09-06 02:18:14 UTC
File Type:
Text (VBS)
AV detection:
9 of 38 (23.68%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k4x2hxjbfdzxmaopshvzvcrhlwj6yid4x3dp4suzqfdjrf4xxcvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/572fa3dd2128f37601cf91eb9a8a275d93ec207cbec6fe4a998146989797b8ab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TelegramAPIMalware_PowerShell_EXE
Create hunting rule
Author:@polygonben
Description:Hunting for pwsh malware using Telegram for C2
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:WIN_ClickFix_Detection
Create hunting rule
Author:dogsafetyforeverone
Description:Detects ClickFix social engineering technique using 'Verify you are human' messages and malicious PowerShell commands
Reference:ClickFix social engineering and malicious PowerShell commands

File information

The table below shows additional information about this malware sample such as delivery method and external references.

ConnectWise

Visual Basic Script (vbs) vbs 572fa3dd2128f37601cf91eb9a8a275d93ec207cbec6fe4a998146989797b8ab

(this sample)

843ba85546072c7b32ce797961f82e5246aac81212e1c251457b137306d839ad

  
Dropping
SHA256 843ba85546072c7b32ce797961f82e5246aac81212e1c251457b137306d839ad
  
Delivery method
Multiple
Cape
Cape
https://www.capesandbox.com/analysis/84153/

Comments